This invention relates to the field of network analysis, and in particular to a technique for estimating the time-varying network latency based on limited traffic trace information. The estimate of time-varying network latency facilitates analysis of the network's performance, and facilitates the estimation of other parameters, such as the estimated transmit time of a received packet, or the estimated receive time of a transmitted packet.
A variety of tools have been developed, and continue to be developed, to facilitate the management of communication networks, and in particular for managing networks that provide communications among computer devices. Many of these tools are configured to model the network's performance under a variety of traffic conditions, both real and hypothesized, and in many cases, base this performance on data collected from the actual network.
Network monitoring devices, commonly referred to as “capture agents”, “sniffers”, or “protocol analyzers”, are often used to capture traffic flow information. Such devices are placed at various points within the network and are configured to monitor the traffic flowing through that point. Generally, these traffic monitoring devices create a record of each message's header information and the time at which the message was detected; if the monitoring device is configured to monitor multiple communication paths at its location, the path information is also stored in the record. The collection of records from one or more monitoring devices is termed ‘trace information’.
Ideally, a network monitoring device would be placed at each node location in a network, so that the time of occurrence (transmission or reception) of each message is accurately recorded. Often, however, the number of monitoring devices is substantially less than the number of nodes of a network, and the times of occurrence of each message at each node can only be estimated, based on the limited availability of trace information.
One of the primary parameters for analyzing or assessing the performance of a network is the time it takes for messages to reliably reach their destination. This time is dependent upon a variety of factors. The message must enter the network, and incurs a delay as it gains network access. When it enters the network, it incurs a delay that is dependent upon the bandwidth available at each link. It may also incur queuing delays as it passes through intermediate nodes, particularly at congested links. Upon arrival at the receiving node, a delay is incurred as the proper receipt of the message is verified. Some of these factors are constant, while others vary over time, typically dependent on network loading.
For ease of reference, the time required for a message/packet to travel from a source node to a destination node is said to comprise a minimum bandwidth-dependent delay, which is determinable/calculatable, and a remainder unknown delay, termed latency.
It would be advantageous to be able to determine time-varying latency estimates based on limited trace information. It would also be advantageous to refine these latency estimates based on known physical limitations. It would also be advantageous to be able to refine these latency estimates based on known protocol characteristics, and in particular, characteristics associated with the Transmission Control Protocol (TCP). It would also be advantageous to use these latency estimates to estimate other parameters related to the monitored network traffic. It would also be advantageous to provide these latency estimates to other network analysis tools.
These advantages can be realized by a method and system that estimates time-varying latency based on the round-trip time between the time of sending a message and the time of receiving an acknowledgement of receipt of the message. The round-trip time relative to a transmitter is modeled as a combination of known, or determinable, delays, plus a time-varying latency, plus a processing/acknowledgement delay at the receiver. The estimated time-varying latency is further refined to give more weight to estimates based on fewer or lesser unknowns, and to impose physical constraints, such as assuring that the estimate does not imply an unrealizable event. TCP-specific constraints and assumptions are also applied to further refine the latency estimates.
Throughout the drawings, the same reference numerals indicate similar or corresponding features or functions. The drawings are included for illustrative purposes and are not intended to limit the scope of the invention.